RETN (AS9002) Prefix Audit
Generated 2026-05-13T10:23:46.643324+00:00. Source: RIPEstat live data.
Summary
- Prefixes audited: 78 (all v4 originated by AS9002)
- Registered as RU: 3
- Jurisdiction-laundering candidates (non-RU country flag but Russian-operator signals in netname/mnt-by/descr/org): 53
- Apparently clean (no Russian-operator signal): 22
Country-flag distribution
| Country | Prefixes |
|---|---|
LV |
46 |
EU |
9 |
NL |
5 |
US |
5 |
DE |
5 |
GB |
4 |
RU |
3 |
PL |
1 |
Jurisdiction-laundering candidates
Prefixes whose registered country is not RU but whose netname, mnt-by, org, or descr indicates Russian-operator control.
| Prefix | Country | Netname | Org | Mnt-by | Signals |
|---|---|---|---|---|---|
139.45.192.0/19 |
EU | RETN-139-45-192-0 | ORG-RL19-RIPE | RIPE-NCC-LEGACY-MNT, MNT-RETN | netname |
155.212.224.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.225.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.226.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.227.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.228.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.229.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.230.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
155.212.231.0/24 |
LV | BGT-RIPE | — | BEGET-MNT | mnt-by |
185.13.152.0/22 |
LV | UK-RETN-20121217 | ORG-RL19-RIPE | MNT-RETN, RIPE-NCC-HM-MNT | netname |
185.77.231.0/24 |
LV | RU-BEGET-20141120 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
185.82.8.0/22 |
GB | UK-RETN-20141222 | ORG-RL19-RIPE | RIPE-NCC-HM-MNT, MNT-RETN | netname |
193.109.100.0/22 |
PL | UK-RETN-20180504 | ORG-RL19-RIPE | MNT-RETN, RIPE-NCC-HM-MNT | netname |
193.22.244.0/24 |
LV | RU-BEGET-20191113 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.23.3.0/24 |
LV | RU-BEGET-20191113 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.242.106.0/24 |
LV | RU-BEGET-20191119 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.242.109.0/24 |
LV | RU-BEGET-20191119 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.28.186.0/24 |
LV | RU-BEGET-20230712 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.43.72.0/24 |
LV | RU-BEGET-20191114 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.56.188.0/24 |
LV | RU-BEGET-20191115 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
193.56.190.0/24 |
LV | RU-BEGET-20191115 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
194.113.209.0/24 |
LV | RU-BEGET-20191122 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
194.36.208.0/24 |
LV | RU-BEGET-20191022 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
2.58.98.0/24 |
LV | RU-BEGET-20190321 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
212.74.231.0/24 |
LV | RU-BEGET-20000526 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
213.139.229.0/24 |
LV | RU-BEGET-20181203 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
31.128.32.0/22 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
37.233.82.0/23 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
37.233.84.0/23 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
37.233.86.0/24 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
45.11.94.0/24 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
45.130.212.0/22 |
LV | RU-BEGET-20190718 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.137.188.0/24 |
LV | RU-BEGET-20190806 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.145.163.0/24 |
LV | RU-BEGET-20190826 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.145.168.0/24 |
LV | RU-BEGET-20190826 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.145.5.0/24 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
45.145.6.0/24 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
45.152.86.0/24 |
LV | RU-BEGET-20190911 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.152.87.0/24 |
LV | RU-BEGET-20190911 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.156.20.0/24 |
LV | RU-BEGET-20190919 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
45.92.174.0/24 |
LV | RU-BEGET-20190701 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
77.73.233.0/24 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
77.73.235.0/24 |
LV | RU-BEGET-20070330 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
77.73.238.0/24 |
LV | RU-BEGET-20070330 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
83.222.20.0/23 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
87.245.208.0/21 |
GB | UK-RETN-20050824 | ORG-RL19-RIPE | RIPE-NCC-HM-MNT, MNT-RETN | netname |
87.245.224.0/19 |
GB | UK-RETN-20050824 | ORG-RL19-RIPE | RIPE-NCC-HM-MNT, MNT-RETN | netname |
89.19.36.0/22 |
NL | UK-RETN-20181009 | ORG-RL19-RIPE | MNT-RETN, RIPE-NCC-HM-MNT | netname |
89.40.204.0/24 |
LV | RU-BEGET-20051129 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
90.156.254.0/23 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
91.193.25.0/24 |
LV | RU-BEGET-20230807 | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-HM-MNT | netname, mnt-by |
91.218.142.0/23 |
LV | LV-BEGET | — | BEGET-MNT | netname, mnt-by |
94.158.240.0/22 |
DE | UK-RETN-20180828 | ORG-RL19-RIPE | MNT-RETN, RIPE-NCC-HM-MNT | netname |
RU-registered prefixes
Prefixes where the country flag itself is RU — no laundering, but the operator concentration is informative for ASN concentration analysis.
| Prefix | Netname | Org | Mnt-by |
|---|---|---|---|
139.45.220.0/22 |
R139-45-220-0 | — | MNT-RETN |
46.173.20.0/24 |
RU-BEGET | ORG-BL131-RIPE | BEGET-MNT, RIPE-NCC-END-MNT |
81.19.134.0/24 |
RU-IVC-20020130 | ORG-ICCL1-RIPE | RIPE-NCC-HM-MNT, IVC-MNT |
Non-RU prefixes with no Russian-operator signal
Customer or transit space genuinely operated outside Russia. Listed for completeness — these likely belong to RETN's Western customer base.
| Prefix | Country | Netname | Org |
|---|---|---|---|
82.23.136.0/24 |
DE | NET-82-23-0-0-16 | ORG-IL687-RIPE |
82.23.137.0/24 |
DE | NET-82-23-0-0-16 | ORG-IL687-RIPE |
82.23.142.0/24 |
DE | NET-82-23-0-0-16 | ORG-IL687-RIPE |
82.23.151.0/24 |
DE | NET-82-23-0-0-16 | ORG-IL687-RIPE |
213.218.244.0/24 |
EU | IPXO | ORG-IL687-RIPE |
213.218.245.0/24 |
EU | IPXO | ORG-IL687-RIPE |
213.218.246.0/24 |
EU | IPXO | ORG-IL687-RIPE |
89.106.28.0/22 |
EU | NET-89-106-28-0-22 | — |
89.106.28.0/24 |
EU | NET-89-106-28-0-22 | — |
89.106.29.0/24 |
EU | NET-89-106-28-0-22 | — |
89.106.30.0/24 |
EU | NET-89-106-28-0-22 | — |
89.106.31.0/24 |
EU | NET-89-106-28-0-22 | — |
213.108.245.0/24 |
GB | UK-WOAF-20180808 | ORG-WTL3-RIPE |
104.121.64.0/23 |
NL | NET104 | American Registry for Internet Numbers ( |
104.121.66.0/23 |
NL | NET104 | American Registry for Internet Numbers ( |
104.121.68.0/23 |
NL | NET104 | American Registry for Internet Numbers ( |
23.56.98.0/24 |
NL | NET23 | American Registry for Internet Numbers ( |
74.112.156.0/22 |
US | IPXO | ORG-CAC5-RIPE |
74.112.156.0/24 |
US | IPXO | ORG-CAC5-RIPE |
74.112.157.0/24 |
US | IPXO | ORG-CAC5-RIPE |
74.112.158.0/24 |
US | IPXO | ORG-CAC5-RIPE |
74.112.159.0/24 |
US | IPXO | ORG-CAC5-RIPE |
What to do with this
- Cross-reference the jurisdiction-laundering candidates against the pipeline's normalized_orgs / target_scorecard — any domain or infrastructure resolving into these /24s belongs in a sanctions review queue.
- Feed RU-registered + laundering candidates into Neo4j as
(:Prefix)-[:HELD_BY]->(:NetHolder)nodes so secondary-scope queries can traverse via infrastructure. - RETN itself (AS9002) is the transit AS here. Add it to the graph as a transit operator and watch for downstream customer ASNs that resell its space.